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> This presentation provides guidance to authorized institutions 
(“Als”) on issues relating to the Anti-Money Laundering and 
Counter-Terrorist Financing (Financial Institutions) Ordinance 
SAMAS and the AMLO Guideline. The presentation is provided 
or training purposes and does not form part of the formal legal 
and regulatory requirements of the HKMA. It should not be 
substituted for seeking detailed advice on any specific case from 
an Al’s own professional adviser. 


> The HKMA is the owner of the copyright and any other rights in 
the PowerPoint materials of this presentation. These materials 
may be used for personal viewing purposes or for use within an Al. 
Such materials may not be reproduced for or distributed to third 
parties, or used for commercial purposes, without the HKMA’s 
prior written consent. 








Correspondent Banking 
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Paragraph 11.1 

e In the AMLO, correspondent banking is designed as the provision of banking services 
(such as credit, deposit, collection, clearing, payment or other similar services) by an Al 
(the correspondent) to another institution (the respondent) to enable the latter to provide 
services and products to its own customers. Correspondent banking activity can include 
establishing accounts, exchanging methods of authentication of instructions, etc. 


> Consistency issues have arisen over ‘the issue of authentication of 
information’ 

> Constructive industry dialogue has taken place through HKAB AML 
Committee 
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Als may adopt the principles set out in Paper - Wolfsberg AML Principles for 
Correspondent [2014] 

Mere exchange of keys may not amount to a Correspondent Banking Relationship 

Where an exchange of non-payment related information is intended, relevant CDD may 
be unnecessary 

Where payment related information is exchanged of intended to be exchanged then Als 
need to carry out CDD as required under AMLO 

It will be for the Al to demonstrate that a correspondent relationship does not exist and 
that the Al is fully compliant with AMLO 

The HKMA will continue to closely scrutinise due diligence and risk management 
practices over Correspondent Banking 
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e To obtain satisfactory evidence of 
the existence, legal form and 
parties 

e Example: 

— obtaining a copy of the trust deed 
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e To obtain appropriate evidence to 


verify the existence, legal form and 
parties to a trust 


e Examples: 

(i) sight of the instrument; 

(ii) ref. to an appropriate register; 

(ili) Confirmation from the trustee 
acting in a professional capacity; 

(iv) confirmation from a lawyer; and 

(v) for trusts that are managed by the 
trust companies which are 
subsidiaries (or affiliate 
companies) of an Al, that Al may 
rely on a written confirmation from 
its trusts subsidiaries etc. 
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Understanding MLI/TF Risk 





> Als must understand the nature and level of ML/TE risks 


— Assessment should include all areas, including products, services, 
targeted customers, entities or geographic locations 


— Detailed analysis of the data should be performed to identify and 
assess the risk within these categories 


— Process for periodically reviewing and updating the risk assessment 
must be adequate and may be assessed 
> Objective is to demonstrate that internal controls and 
AML/CFT programmes been developed to adequately 
mitigate those ML/TF risks 


— Board should consider whether the AML/CFT programme ultimately 
leads to a reduction in ML/TF activity that has been identified 


Understanding MLITF Risk - 
Existing obligation 





AMLO Guideline 


: 
Country risk 


3.3 An effective RBA does involve identifying and categorizing 
ML/TF risks at the customer level and establishing 
reasonable measures based on the risk identified 
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Regulatory Expectation 





Objective is to assess the Al’s ML/TF risk profile and evaluate 
the adequacy of the its ML/TF risk assessment process 


HKMA will obtain and review the Al’s ML/TF risk assessment 
as part of the examination scoping exercise: 


— Has Al included all risk areas, including any new products, services, or 
targeted customers, entities, and geographic locations? 


— Is the process for periodically reviewing and updating the ML/TF risk 
assessment adequate? 


— Is the risk assessment in written form? 


— Has the risk assessment been shared and communicated with all 
business lines across the bank, board of directors, management, and 
appropriate staff? Do those staff understand the risk assessment? 


ML/TF risk profile will be discussed with the Al 


Purpose & intended nature of | ne 
the business relationship 





> Means developing a more comprehensive picture of the 
customer and includes, for example, measures to establish 
customer’s occupation and source of funds 

> Key information for solid basis for ongoing monitoring 
— Guidance paper [December 2013] footnote 7 on Page 8 
— Legal obligation under AMLO, section 2(1)(c) of Schedule 2 

> Meaningful steps must be taken, generic information 
insufficient 
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Source of Wealth 





Fundamental control in Private Banking and Wealth 
Management 


Observations: 


— Risk-based due diligence needs to be adequate, guidance to front line 
staff needs to be clear 

— Adequate documentation should be maintained 

— Should not accept overly simplistic explanations at face value without 
challenge 

— Strong oversight essential 

Senior management must ensure there must be a culture in 

which RMs take responsibility for making ethical decisions 

based on knowledge of the customer 
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Regulatory Expectation 





Information obtained must be meaningful 

— Risk-sensitive measures should be applied to verify information 

— Must be evidence of challenge and escalation where appropriate 
especially where there are elevated risks associated with the 
relationship 

Where relevant information about a higher risk customer’s 

source of wealth was obtained, verify this and do not put 

reliance solely on the word of customers 

— Should not be routine 
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Internal Audit 





> Effectiveness of Internal Audit Reviews 
— IA should play a strong role and identify control failures 
— Specialist resources may be used where appropriate 

> Frequency & scope of reviews must address Bank’s risks 
— Correlation with risk assessment will be examined 


> Observations of recent IA and compliance reviews on AML 
controls often do not drive change 


Quality issues or information not discussed at sufficiently senior level 
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Transaction Monitoring 





Guidance Paper 


Als should take into account the size, nature and complexity of its 
business in an appropriate assessment, prior to the launch of the 
transaction monitoring system. To ensure adequate coverage of its 
business operations, the assessment should take into consideration 
the question of whether to implement, and if so the appropriate 
degree of, automation that is required for the transaction 
monitoring system. This assessment should be in writing as a 


record of the rationale for adopting the system, including how it 
meets the APs needs and other material factors such as the 
appropriateness of the system vendor, the effectiveness of the 
interface between the new system and the AI’s existing 
infrastructure, how updates will be undertaken and any resource 
implications. 
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Transaction Monitoring 





Guidance Paper 


Als should ensure, through the establishment of policies and 
procedures, the requirement to periodically review the transaction 
monitoring system. This should include an assessment of the 
transaction characteristics it monitors, risk factors, parameters and 


thresholds used to ensure they remain optimal for the AI and 
address ML/TF risk, taking into account changes in business 
operations and developments in ML/TF methods. 
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Are the Als transaction monitoring systems adequate, given 
their business activities and size? 

Depending on nature and scale of the Al, automated systems 
may be important for effective AML controls 

— Role of senior management emphasised in recent guidance paper 
Understanding risks — the starting point 

— Sufficiently detailed system review is required 

Should have a clear understanding of what the system could 
deliver / limitations 

— TM can only supplement, not replace human element 
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Ongoing Due Diligence 





Section 5(1)(a) of Schedule 2 to the AMLO 


> “A financial institution must continuously monitor its business relationship 
with a customer by reviewing from time to time documents, data and 
information relating to the customer that have been obtained by the financial 


institution for the purpose of complying with the requirements imposed under 
this Part to ensure that they are up-to-date and relevant” 
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Ongoing Due Diligence 





“From Time to Time” / “Periodic” 


> Paragraph 4.7.12 - Fis should take steps from time to time to ensure that 
the customer information that has been obtained for the purposes of 
complying with the requirements of sections 2 and 3 of Schedule 2 are up- 
to-date and relevant. To achieve this, an FI should undertake periodic 
reviews of existing records of customers. 
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Verifying Corporate Identity 





Paragraph 4.9.11 
The FI should verify the information in paragraph 4.9.10 from: 


for a locally incorporated company: 


(a) a search of file at the Hong Kong Company Registry and 
obtain a company report; 


for a company incorporated overseas: 


(b) a similar company search enquiry of the registry in the place 
of incorporation and obtain a company report; 


(c) a certificate of incumbency or equivalent issued by the 
company’s registered agent in the place of incorporation; or 


(d) a similar or comparable document to a company search 
report or a certificate of incumbency certified by a 
professional third party in the relevant jurisdiction verifying 
that the information at paragraph 4.9.10, contained in the 
said document, is correct and accurate. 
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STRs made to JFIU in the 
past 10 years 





2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 


e Represents number of STR made by Banks 
(As of 31 May 2014, 12,931 STRs had been filed by banks) 
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Wire Transfers 





$12(3), 12(4) and 12(5) of Schedule 2 to the AMLO 


> Before carrying out a wire transfer, a financial institution that is an ordering 
institution must record (i) the originator's name; (ii) the originator’s 
account number and (iii) the originator’s address. 


> Ordering Institution must include the verified originator’s information in the 
wire transfer message. 
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Wire Transfers 





> Observations during examinations: 
— Automatic extraction process needs oversight 

> Adequate IA or Compliance review is important 
— Sampling important 


> Straight forward AMLO provision 
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Governance 





> Ownership by all stakeholders, including commitment of the Board 
and senior management of Banks, to strong AML culture and 


controls 
— Training may have to be very specific at board level, tailored for executive 


management 
> Can the board and senior management see what the real risks are? 
Is there audit evidence of how senior management make decisions on 
ML/TF risks? 
— Are they the correct decisions? 
— Responsibility Als to decide 
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Key Points 





> Risk Assessments 

— National Risk Assessment [‘NRA’] will commence soon 

— Understanding ML/TF risks central to strong AML/CFT systems for Als 
> Understand purpose and intended nature of relationship 

— Retail — will help to reduce exposure to criminal activity 

— PBs — source of wealth and funds remains a core CDD component 


> Perform Gap Analysis on Guidance paper on Transaction Monitoring 
— Review system requirements and level of automation that may be 
required, now and in the future 
> Periodic reviews are important to ensure CDD is up to date and 
relevant 
> Quality of STR reporting 


— Self assess - be proactive and have a plan to improve quality 
> Understand and mitigate ML/TF risks in Trade Finance 


— Future supervisory focus 
25 








Questions 





